Privacy Policy

Last Updated: October 2026

Introduction

At Rosy Solutions Ltd (“we”, “us”), your privacy matters. We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Rosy Solutions Ltd is registered with the Information Commissioner’s Office (ICO) as a Data Controller.

Data Controller: Rosy Solutions Ltd
Company number: 16436726
ICO registration number: 1669455
Data Protection Contact: Emily Rose
Email: important@rosy-solutions.com
Address: 124 City Road, London EC1V 2NX

This notice explains how we collect, use, store, share and protect your personal data, both as a client and when you visit this website.

We may update this notice from time to time. The most current version will always be on this page.

How we might receive personal data

We collect personal data directly from you when you:

request a proposal or quote
become a client or enquire about services
book a call or use the contact form on this website
complete an onboarding form or provide information for AML checks
communicate with us by email, phone, video call, post, website or social media (with your agreement, we may create a written transcript of calls, see “Call notes and AI tools” below)

We may also collect data indirectly from:

HMRC or Companies House
banks or financial institutions
employers (if relevant)
third-party software (e.g., QuickBooks, Xero, Hubdoc, payroll systems)
professional advisers
publicly available sources

This list is not exhaustive. If we need to obtain your personal data from a third party, we will usually let you know beforehand.

Types of personal data we process

Depending on your engagement, we may process:

name, address, date of birth and contact details
National Insurance number, UTR and tax information
financial records required for bookkeeping, accounts or tax returns
bank statements, payroll information and business records
identity documents for AML checks (e.g., passport, driving licence)
correspondence between you and us, including call transcripts and notes

We do not intentionally collect “special category data” (such as health information) unless you provide it as part of your financial records, for example medical information relating to employee benefits. If this happens, we handle it with extra care.

The lawful bases on which we process personal data

We process your personal data under the following lawful bases:

Contract: to provide services under our Engagement Letter(s)
Legal obligation: to comply with AML regulations, tax and accounting laws, and professional rules
Legitimate interests: practice management, keeping accurate records of our conversations, regulatory compliance, business continuity and quality assurance
Consent: only where we explicitly ask for it (e.g., marketing emails)

If you do not provide the information we request, we may be unable to provide our services.

Why we process personal data

We use your personal data to:

provide bookkeeping, tax, accountancy and advisory services
verify identity (AML checks)
prepare and file submissions with HMRC or other authorities
manage our client relationship and billing
meet regulatory and professional obligations
correspond with you effectively and securely
improve our services and carry out internal quality checks

If you have given consent, we may also contact you with information about services that may be helpful to you.

Call notes and AI tools

With your agreement, we use a note-taking tool called Granola to create a written transcript of our calls, and AI tools to help summarise them. This helps us keep an accurate record of what we discussed and agreed, so nothing gets missed.

We will always ask before transcribing a call. You are welcome to say no, now or at any time, and it won’t affect our work together.

We also use AI tools, including Claude (by Anthropic), to help with tasks like summarising notes, drafting emails and organising our work. These tools may access information we hold about you in our practice management system. They support our work but never replace it: Emily reviews everything, and all advice and decisions are made by a person.

The providers we use act only on our instructions, are bound by data protection agreements, and are not permitted to use your information to train their AI models.

Data security

We take data security seriously and have appropriate technical and organisational measures in place, including:

secure cloud-based storage
restricted access to systems
password protection and encryption where required
regular system monitoring
secure transmission practices

No online system is completely risk-free, but we act promptly to investigate and manage any suspected data breach.

Data sharing

We only share your data when necessary and in line with the purposes described in this notice. Examples include:

Service providers and third-party processors (e.g., accounting software, payroll platforms, secure portals, our practice management system, call transcription and AI tools)
Regulators or authorities (e.g., HMRC, CIMA, OPBAS, law enforcement, courts)
Professional advisers (e.g., insurers, legal advisers)
Subcontractors working on your file, all of whom are bound by confidentiality and data protection agreements
An alternate appointed professional, to ensure continuity of service in the event of Emily Rose’s incapacity or death

We do not sell your data.

International transfers

Some of the tools we use, including our call transcription and AI providers, store or process data in the United States. Where this happens, we make sure appropriate safeguards are in place, such as UK-approved data transfer agreements, and we only use reputable providers with strong security.

Data retention

We keep personal data only for as long as necessary under:

legal and regulatory requirements
professional standards
the nature of your engagement

Typical retention periods:

Tax and accounting records: 7 years from the end of the tax year
Advisory work: 7 years after the business relationship ends
Ongoing client records (important historical data): kept for the length of our relationship, then deleted after 7 years unless you ask otherwise
Call transcripts and summaries: kept for the length of our engagement, then deleted. Anything important is saved to your client file
Website enquiries: kept for 90 days, unless you go on to become a client

As set out in our Terms of Business, documents may be destroyed after the retention period.

Where we act as a Data Processor (e.g., payroll), we delete or return data at the end of the engagement according to your instructions.

Using this website

Contact form and booking a call

If you get in touch through the contact form or book a call, we use the details you give us only to reply to you and arrange the call. Contact form messages are stored securely on our website for 90 days, then deleted. Bookings are managed through Microsoft Bookings.

Website hosting and security

This website is hosted by Pressable, part of Automattic, which may store and process data in the United States (see “International transfers” above). To protect the site from attacks, our security tools record the IP addresses of anyone trying to log in.

Spam protection

Messages sent through our contact form may be checked by Akismet, an automated spam detection service run by Automattic. To do this, Akismet receives your IP address, browser details, the page you came from, and the information you entered, such as your name, email address and message. You can read Automattic’s privacy policy at automattic.com/privacy.

Cookies and analytics

This website uses a small number of cookies that it needs to work properly. These do not identify you personally.

If you are a site administrator and log in, WordPress also sets cookies to remember your login and display settings. Ordinary visitors will not receive these cookies.

We use Jetpack Stats, provided by Automattic, to understand how visitors use this website, such as which pages are visited and how people find us. This helps us improve the site. To do this, Automattic receives information such as your IP address, browser details, the pages you visit and the website you came from, and may set a cookie with a random visitor ID. We do not use this information to identify you. You can choose to accept or decline these cookies when you first visit the site.

You can also control or delete cookies through your browser settings at any time.

Links and embedded content

This website links to, and may include content from, other websites such as LinkedIn, Facebook and Microsoft. If you click through or view embedded content, those websites may collect data about you and use their own cookies, in the same way as if you had visited them directly. Their own privacy policies apply.

Individuals’ rights regarding their data

You have the following rights:

Right of access: to request a copy of your data
Right to rectification: to correct inaccurate data
Right to erasure (“right to be forgotten”): in certain circumstances
Right to restrict processing: to pause our use of your data
Right to object: where processing is based on legitimate interests
Right to data portability: to receive your data in a machine-readable format
Right to withdraw consent: where consent is the legal basis

We will respond within one month, unless the request is complex or repeated, in which case an extension may apply.

To exercise your rights, contact Emily Rose at important@rosy-solutions.com.

Contact details

If you have any questions about this notice or how we handle your data, please contact:

Emily Rose
Rosy Solutions Ltd
Email: important@rosy-solutions.com

If you remain concerned, you can contact the ICO:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk/concerns